acryl-datahub missing JWT signature check
The advisory, in context
Missing JWT signature check (GHSL-2022-078)
The StatelessTokenService of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the StatelessTokenService of the Metadata service uses the parse method of io.jsonwebtoken.JwtParser, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm.
Impact
This issue may lead to an authentication bypass.
Resources
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 0.8.45
Fixed in 0.8.45
321 explicitly affected versions
0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.4.0, 0.8.1.0, 0.8.1.1, 0.8.1.2, 0.8.10.0, 0.8.10.1, 0.8.10.2, 0.8.11.0, 0.8.11.1, 0.8.12.0, 0.8.13.0, 0.8.13.1, 0.8.14.0, 0.8.14.1, 0.8.14.2, 0.8.15.0, 0.8.15.1, 0.8.15.10, 0.8.15.2, 0.8.15.3, 0.8.15.4, 0.8.15.5, 0.8.15.6, 0.8.15.7, 0.8.15.8, 0.8.15.9, 0.8.16.0, 0.8.16.1, 0.8.16.11, 0.8.16.12, 0.8.16.2, 0.8.16.3, 0.8.16.4, 0.8.16.5, 0.8.16.6, 0.8.16.7, 0.8.16.8, 0.8.16.9, 0.8.17.0, 0.8.17.1, 0.8.17.2, 0.8.17.3, 0.8.17.4, 0.8.17.5, 0.8.17.6, 0.8.17.7, 0.8.18, 0.8.18.1, 0.8.19.0, 0.8.19.1, 0.8.20.0, 0.8.21.0, 0.8.22.1, 0.8.23.0, 0.8.23.1, 0.8.24.0, 0.8.24.1, 0.8.24.2, 0.8.24.3, 0.8.25, 0.8.25.1, 0.8.25.2, 0.8.26.0, 0.8.26.1, 0.8.26.2, 0.8.26.3, 0.8.26.4, 0.8.26.5, 0.8.26.6, 0.8.26.7, 0.8.26.7rc1, 0.8.26.7rc2, 0.8.26.8, 0.8.26.8rc1, 0.8.27, 0.8.27.1, 0.8.27.1rc1, 0.8.27.2, 0.8.27.2rc1, 0.8.27.2rc2, 0.8.27.2rc3, 0.8.28.0, 0.8.28.0rc1, 0.8.28.1, 0.8.29, 0.8.29.1, 0.8.29.2, 0.8.3.0, 0.8.3.1, 0.8.3.2, 0.8.3.3, 0.8.30.0, 0.8.31, 0.8.31.1, 0.8.31.1rc1, 0.8.31.2, 0.8.31.3, 0.8.31.3rc1, 0.8.31.4, 0.8.31.4rc1, 0.8.31.5, 0.8.31.5rc1, 0.8.31.6, 0.8.31.6rc1, 0.8.31.6rc2, 0.8.32, 0.8.32.1, 0.8.32.2, 0.8.32.2rc1, 0.8.32.3, 0.8.32.3rc1, 0.8.32.4, 0.8.32.4rc1, 0.8.32.4rc2, 0.8.32.5, 0.8.32.5rc1, 0.8.32.6, 0.8.32.6rc2, 0.8.32.6rc3, 0.8.32.7, 0.8.32rc1, 0.8.32rc2, 0.8.32rc3, 0.8.32rc4, 0.8.33, 0.8.33.1, 0.8.33.2, 0.8.33.2rc1, 0.8.33.2rc2, 0.8.33.3, 0.8.33.3rc2, 0.8.33.3rc3, 0.8.33rc1, 0.8.34, 0.8.34.1, 0.8.34.1rc1, 0.8.34.1rc2, 0.8.34.1rc3, 0.8.34.2, 0.8.34.2rc1, 0.8.34.2rc2, 0.8.34.2rc3, 0.8.34.2rc4, 0.8.34.3rc1, 0.8.35, 0.8.35.0rc2, 0.8.35.1, 0.8.35.1rc1, 0.8.35.2, 0.8.35.2rc1, 0.8.35.3, 0.8.35.3rc1, 0.8.35.4, 0.8.35.4rc1, 0.8.35.5, 0.8.35.5rc1, 0.8.35.6, 0.8.35.6rc1, 0.8.35.6rc2, 0.8.35.7, 0.8.35.7rc1, 0.8.35.8rc1, 0.8.35.8rc2, 0.8.35.8rc3, 0.8.36, 0.8.36.0rc0, 0.8.36.1rc1, 0.8.36.1rc10, 0.8.36.1rc2, 0.8.36.1rc6, 0.8.36.1rc7, 0.8.36.1rc8, 0.8.36.1rc9, 0.8.36rc1, 0.8.37, 0.8.37rc0, 0.8.38, 0.8.38.1, 0.8.38.1rc0, 0.8.38.1rc1, 0.8.38.2, 0.8.38.2rc1, 0.8.38.3, 0.8.38.3rc1, 0.8.38.4, 0.8.38.4rc0, 0.8.38.4rc2, 0.8.38.4rc3, 0.8.38.5, 0.8.38.5rc0, 0.8.39, 0.8.39.1rc1, 0.8.39.1rc2, 0.8.39.1rc3, 0.8.39.1rc4, 0.8.39.1rc5, 0.8.39.1rc6, 0.8.39.1rc7, 0.8.39.1rc8, 0.8.39rc0, 0.8.4.0, 0.8.40, 0.8.40.1, 0.8.40.2, 0.8.40.2rc0, 0.8.40.3, 0.8.40.3rc0, 0.8.40.3rc1, 0.8.40.3rc2, 0.8.40.3rc3, 0.8.40.4rc1, 0.8.40.4rc2, 0.8.40rc1, 0.8.41, 0.8.41.1, 0.8.41.1rc0, 0.8.41.1rc1, 0.8.41.1rc2, 0.8.41.1rc3, 0.8.41.1rc4, 0.8.41.2, 0.8.41.2rc0, 0.8.41.2rc1, 0.8.41.3rc1, 0.8.41.3rc2, 0.8.41.3rc3, 0.8.41rc2, 0.8.42, 0.8.42rc1, 0.8.42rc2, 0.8.43, 0.8.43.1, 0.8.43.1rc0, 0.8.43.1rc1, 0.8.43.2, 0.8.43.2rc0, 0.8.43.2rc1, 0.8.43.3, 0.8.43.3rc0, 0.8.43.3rc1, 0.8.43.3rc2, 0.8.43.3rc3, 0.8.43.3rc5, 0.8.43.4, 0.8.43.4rc1, 0.8.43.4rc2, 0.8.43.5, 0.8.43.5rc1, 0.8.43.5rc2, 0.8.43.5rc3, 0.8.43.6, 0.8.43.6rc0, 0.8.43.6rc1, 0.8.43rc2, 0.8.43rc3, 0.8.43rc4, 0.8.44, 0.8.44.1, 0.8.44.1rc0, 0.8.44.1rc1, 0.8.44.1rc2, 0.8.44.1rc3, 0.8.44.1rc4, 0.8.44.2, 0.8.44.2rc0, 0.8.44.2rc1, 0.8.44.2rc2, 0.8.44.3, 0.8.44.3rc0, 0.8.44.3rc1, 0.8.44.3rc2, 0.8.44.3rc3, 0.8.44.3rc4, 0.8.44.4, 0.8.44.4rc0, 0.8.44.4rc1, 0.8.44.5, 0.8.44.5rc0, 0.8.44.5rc1, 0.8.44.5rc2, 0.8.44.5rc3, 0.8.44.6rc0, 0.8.44rc0, 0.8.44rc1, 0.8.44rc3, 0.8.44rc4, 0.8.44rc5, 0.8.45rc1, 0.8.5.0, 0.8.5.1, 0.8.5.2, 0.8.6.0, 0.8.6.1, 0.8.6.2, 0.8.6.3, 0.8.6.4, 0.8.6.5, 0.8.7.0, 0.8.8.0, 0.8.8.1, 0.8.8.2, 0.8.8.3, 0.8.8.4, 0.8.9.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.45"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.2",
"0.0.3",
"0.0.4",
"0.0.5",
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.3",
"0.2.0",
"0.2.1",
"0.2.2",
"0.2.3",
"0.3.0",
"0.3.1",
"0.3.2",
"0.3.3",
"0.3.4",
"0.4.0",
"0.8.1.0",
"0.8.1.1",
"0.8.1.2",
"0.8.10.0",
"0.8.10.1",
"0.8.10.2",
"0.8.11.0",
"0.8.11.1",
"0.8.12.0",
"0.8.13.0",
"0.8.13.1",
"0.8.14.0",
"0.8.14.1",
"0.8.14.2",
"0.8.15.0",
"0.8.15.1",
"0.8.15.10",
"0.8.15.2",
"0.8.15.3",
"0.8.15.4",
"0.8.15.5",
"0.8.15.6",
"0.8.15.7",
"0.8.15.8",
"0.8.15.9",
"0.8.16.0",
"0.8.16.1",
"0.8.16.11",
"0.8.16.12",
"0.8.16.2",
"0.8.16.3",
"0.8.16.4",
"0.8.16.5",
"0.8.16.6",
"0.8.16.7",
"0.8.16.8",
"0.8.16.9",
"0.8.17.0",
"0.8.17.1",
"0.8.17.2",
"0.8.17.3",
"0.8.17.4",
"0.8.17.5",
"0.8.17.6",
"0.8.17.7",
"0.8.18",
"0.8.18.1",
"0.8.19.0",
"0.8.19.1",
"0.8.20.0",
"0.8.21.0",
"0.8.22.1",
"0.8.23.0",
"0.8.23.1",
"0.8.24.0",
"0.8.24.1",
"0.8.24.2",
"0.8.24.3",
"0.8.25",
"0.8.25.1",
"0.8.25.2",
"0.8.26.0",
"0.8.26.1",
"0.8.26.2",
"0.8.26.3",
"0.8.26.4",
"0.8.26.5",
"0.8.26.6",
"0.8.26.7",
"0.8.26.7rc1",
"0.8.26.7rc2",
"0.8.26.8",
"0.8.26.8rc1",
"0.8.27",
"0.8.27.1",
"0.8.27.1rc1",
"0.8.27.2",
"0.8.27.2rc1",
"0.8.27.2rc2",
"0.8.27.2rc3",
"0.8.28.0",
"0.8.28.0rc1",
"0.8.28.1",
"0.8.29",
"0.8.29.1",
"0.8.29.2",
"0.8.3.0",
"0.8.3.1",
"0.8.3.2",
"0.8.3.3",
"0.8.30.0",
"0.8.31",
"0.8.31.1",
"0.8.31.1rc1",
"0.8.31.2",
"0.8.31.3",
"0.8.31.3rc1",
"0.8.31.4",
"0.8.31.4rc1",
"0.8.31.5",
"0.8.31.5rc1",
"0.8.31.6",
"0.8.31.6rc1",
"0.8.31.6rc2",
"0.8.32",
"0.8.32.1",
"0.8.32.2",
"0.8.32.2rc1",
"0.8.32.3",
"0.8.32.3rc1",
"0.8.32.4",
"0.8.32.4rc1",
"0.8.32.4rc2",
"0.8.32.5",
"0.8.32.5rc1",
"0.8.32.6",
"0.8.32.6rc2",
"0.8.32.6rc3",
"0.8.32.7",
"0.8.32rc1",
"0.8.32rc2",
"0.8.32rc3",
"0.8.32rc4",
"0.8.33",
"0.8.33.1",
"0.8.33.2",
"0.8.33.2rc1",
"0.8.33.2rc2",
"0.8.33.3",
"0.8.33.3rc2",
"0.8.33.3rc3",
"0.8.33rc1",
"0.8.34",
"0.8.34.1",
"0.8.34.1rc1",
"0.8.34.1rc2",
"0.8.34.1rc3",
"0.8.34.2",
"0.8.34.2rc1",
"0.8.34.2rc2",
"0.8.34.2rc3",
"0.8.34.2rc4",
"0.8.34.3rc1",
"0.8.35",
"0.8.35.0rc2",
"0.8.35.1",
"0.8.35.1rc1",
"0.8.35.2",
"0.8.35.2rc1",
"0.8.35.3",
"0.8.35.3rc1",
"0.8.35.4",
"0.8.35.4rc1",
"0.8.35.5",
"0.8.35.5rc1",
"0.8.35.6",
"0.8.35.6rc1",
"0.8.35.6rc2",
"0.8.35.7",
"0.8.35.7rc1",
"0.8.35.8rc1",
"0.8.35.8rc2",
"0.8.35.8rc3",
"0.8.36",
"0.8.36.0rc0",
"0.8.36.1rc1",
"0.8.36.1rc10",
"0.8.36.1rc2",
"0.8.36.1rc6",
"0.8.36.1rc7",
"0.8.36.1rc8",
"0.8.36.1rc9",
"0.8.36rc1",
"0.8.37",
"0.8.37rc0",
"0.8.38",
"0.8.38.1",
"0.8.38.1rc0",
"0.8.38.1rc1",
"0.8.38.2",
"0.8.38.2rc1",
"0.8.38.3",
"0.8.38.3rc1",
"0.8.38.4",
"0.8.38.4rc0",
"0.8.38.4rc2",
"0.8.38.4rc3",
"0.8.38.5",
"0.8.38.5rc0",
"0.8.39",
"0.8.39.1rc1",
"0.8.39.1rc2",
"0.8.39.1rc3",
"0.8.39.1rc4",
"0.8.39.1rc5",
"0.8.39.1rc6",
"0.8.39.1rc7",
"0.8.39.1rc8",
"0.8.39rc0",
"0.8.4.0",
"0.8.40",
"0.8.40.1",
"0.8.40.2",
"0.8.40.2rc0",
"0.8.40.3",
"0.8.40.3rc0",
"0.8.40.3rc1",
"0.8.40.3rc2",
"0.8.40.3rc3",
"0.8.40.4rc1",
"0.8.40.4rc2",
"0.8.40rc1",
"0.8.41",
"0.8.41.1",
"0.8.41.1rc0",
"0.8.41.1rc1",
"0.8.41.1rc2",
"0.8.41.1rc3",
"0.8.41.1rc4",
"0.8.41.2",
"0.8.41.2rc0",
"0.8.41.2rc1",
"0.8.41.3rc1",
"0.8.41.3rc2",
"0.8.41.3rc3",
"0.8.41rc2",
"0.8.42",
"0.8.42rc1",
"0.8.42rc2",
"0.8.43",
"0.8.43.1",
"0.8.43.1rc0",
"0.8.43.1rc1",
"0.8.43.2",
"0.8.43.2rc0",
"0.8.43.2rc1",
"0.8.43.3",
"0.8.43.3rc0",
"0.8.43.3rc1",
"0.8.43.3rc2",
"0.8.43.3rc3",
"0.8.43.3rc5",
"0.8.43.4",
"0.8.43.4rc1",
"0.8.43.4rc2",
"0.8.43.5",
"0.8.43.5rc1",
"0.8.43.5rc2",
"0.8.43.5rc3",
"0.8.43.6",
"0.8.43.6rc0",
"0.8.43.6rc1",
"0.8.43rc2",
"0.8.43rc3",
"0.8.43rc4",
"0.8.44",
"0.8.44.1",
"0.8.44.1rc0",
"0.8.44.1rc1",
"0.8.44.1rc2",
"0.8.44.1rc3",
"0.8.44.1rc4",
"0.8.44.2",
"0.8.44.2rc0",
"0.8.44.2rc1",
"0.8.44.2rc2",
"0.8.44.3",
"0.8.44.3rc0",
"0.8.44.3rc1",
"0.8.44.3rc2",
"0.8.44.3rc3",
"0.8.44.3rc4",
"0.8.44.4",
"0.8.44.4rc0",
"0.8.44.4rc1",
"0.8.44.5",
"0.8.44.5rc0",
"0.8.44.5rc1",
"0.8.44.5rc2",
"0.8.44.5rc3",
"0.8.44.6rc0",
"0.8.44rc0",
"0.8.44rc1",
"0.8.44rc3",
"0.8.44rc4",
"0.8.44rc5",
"0.8.45rc1",
"0.8.5.0",
"0.8.5.1",
"0.8.5.2",
"0.8.6.0",
"0.8.6.1",
"0.8.6.2",
"0.8.6.3",
"0.8.6.4",
"0.8.6.5",
"0.8.7.0",
"0.8.8.0",
"0.8.8.1",
"0.8.8.2",
"0.8.8.3",
"0.8.8.4",
"0.8.9.0"
]
}References
- https://github.com/datahub-project/datahub/security/advisories/GHSA-r8gm-v65f-c973
- https://nvd.nist.gov/vuln/detail/CVE-2022-39366
- https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check
- https://github.com/datahub-project/datahub
- https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134
- https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30
- https://github.com/datahub-project/datahub/releases/tag/v0.8.45
- https://github.com/pypa/advisory-database/tree/main/vulns/acryl-datahub/PYSEC-2026-252.yaml
- https://pypi.org/project/acryl-datahub